user and password available in poetry.lock

• I am on the latest Poetry version.

• I have searched the issues of this repo and believe that this is not a duplicate.

• OS version and name: Debian 10 (buster)

• Poetry version: 1.1.4

Issue

I'm unsure this should be considered as a bug.

In poetry.lock, the url field fills packages location. If HTTP authentication is used, the user and password are provided in the URL so it's readable in the file. For example:

[package.source]
type = "legacy"
url = "https://alice:a_passwd@pypi.domain.tld/site/prod/+simple"
reference = "whatever"

It could be replaced by https://**user**:**password**@.... However, I wonder if it's the good strategy because the poetry.lock file can't be used directly to rebuild a virtualenv without doing search/replace those strings. What do you think about it?

I could provide a PR but I prefer to get some feedback before.

Start by inspecting how Poetry writes the url field under [package.source] in poetry.lock, and review the issue discussion for the unresolved trade-off between hiding credentials and rebuilding environments. Determine the expected handling of authenticated URLs and verify that lockfile use remains well-defined without exposing secrets.